Make REST token bootstrap cache safe

[acodebeard]

Summary

• Adds a same-site /bootstrap REST endpoint that returns the per-visitor endpoint token on demand.
• Stops embedding visitor-specific endpoint tokens in rendered planner HTML so cached pages do not reuse another visitor's token.
• Updates the frontend to fetch a fresh token before browse/route REST requests.
• Updates browser fixture routing and tests for the new bootstrap contract.

Verification

• composer test in plugin/plan-your-day passed: 107 tests, 564 assertions.
• node --check plugin/plan-your-day/assets/js/plan.js
• git diff --check
• npm run browser-smoke passed: 7 tests.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89549fd8da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Re-check request freshness after token bootstrap

When the first REST request has to wait for /bootstrap, aborting it does not stop execution here because ensureEndpointToken() is not tied to the request's AbortController. If a user quickly changes searches/categories before bootstrap resolves, the stale request resumes after the token arrives and sends its browse/route fetch using the newer global activeRequestController.signal, so cancelled requests still hit the REST API and can consume rate limit/API quota before their response is discarded. Capture the controller/signal for this request or check requestId !== activeRequestId immediately after the bootstrap await before issuing the endpoint fetch.

Useful? React with 👍 / 👎.